CVE-2021-28162 — In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run

Matched remediation archetype

Supply-chain, dependency, build, and update integrity

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Trace affected packages, source archives, build actions, plugins, installers, and updates from declared source to deployed artifact.
• Confirm provenance, signatures or digests, namespace ownership, lockfile resolution, registry configuration, and build-runner trust boundaries.
• Inventory direct, transitive, vendored, generated, and bundled copies across releases and distribution channels.

Remediate safely

• Move to a maintained trusted artifact or remove the dependency; pin immutable identities and verify provenance and integrity before use.
• Regenerate lockfiles and artifacts in a clean isolated build, minimize build credentials and network access, and produce an updated software bill of materials.
• Require reviewed update policy, protected publishing, and reproducible or independently attestable builds where supported.